Analysis
-
max time kernel
113s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 18:48
Static task
static1
Behavioral task
behavioral1
Sample
2f777dad2191c26d1472b8e4c612fc1c372e810adc851fafa7601a819bda1c10.dll
Resource
win7-20240221-en
General
-
Target
2f777dad2191c26d1472b8e4c612fc1c372e810adc851fafa7601a819bda1c10.dll
-
Size
120KB
-
MD5
d5ade40fb3fe4bfedee0f76af1816bd9
-
SHA1
9d08f618fe80ec923576ebc774e1e6fd438ab785
-
SHA256
2f777dad2191c26d1472b8e4c612fc1c372e810adc851fafa7601a819bda1c10
-
SHA512
cbecfb09f4258d64580d6735d7fbd4ae6fec3127bc061737ed3dfc8751bcf080a6a44a4a5d93c34643d3edf1ee84c0a63ad14c26299c20ce962610326ba5b8b4
-
SSDEEP
3072:Jnm9qtiAfpKdBgZoUEC2onnIMAnCAgtVEr3DvzJAW:wqiAWUEClnnTQrUErv
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
e57e985.exee580134.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57e985.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57e985.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57e985.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e580134.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e580134.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e580134.exe -
Processes:
e57e985.exee580134.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e985.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e580134.exe -
Processes:
e57e985.exee580134.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57e985.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e580134.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e580134.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e580134.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e580134.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e580134.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57e985.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57e985.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57e985.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57e985.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e580134.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57e985.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 28 IoCs
Processes:
resource yara_rule behavioral2/memory/2368-6-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-8-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-9-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-10-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-18-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-29-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-30-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-31-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-32-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-34-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-33-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-35-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-36-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-48-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-50-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-52-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-53-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-54-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-57-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-67-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-71-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-73-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-76-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-78-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-80-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2368-82-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4036-106-0x0000000000B50000-0x0000000001C0A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4036-142-0x0000000000B50000-0x0000000001C0A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 33 IoCs
Processes:
resource yara_rule behavioral2/memory/2368-6-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-8-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-9-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-10-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-18-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-29-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-30-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-31-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-32-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-34-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-33-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-35-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-36-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4036-45-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2368-48-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-50-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-52-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-53-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-54-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-57-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-67-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-71-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-73-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-76-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-78-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-80-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-82-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2368-101-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2896-104-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4036-106-0x0000000000B50000-0x0000000001C0A000-memory.dmp UPX behavioral2/memory/1724-141-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4036-143-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4036-142-0x0000000000B50000-0x0000000001C0A000-memory.dmp UPX -
Executes dropped EXE 4 IoCs
Processes:
e57e985.exee57f03c.exee580134.exee5801d0.exepid process 2368 e57e985.exe 2896 e57f03c.exe 4036 e580134.exe 1724 e5801d0.exe -
Processes:
resource yara_rule behavioral2/memory/2368-6-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-8-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-9-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-10-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-18-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-29-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-30-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-31-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-32-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-34-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-33-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-35-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-36-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-48-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-50-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-52-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-53-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-54-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-57-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-67-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-71-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-73-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-76-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-78-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-80-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2368-82-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4036-106-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/4036-142-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx -
Processes:
e57e985.exee580134.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57e985.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57e985.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e580134.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e580134.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57e985.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e580134.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e580134.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57e985.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57e985.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57e985.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57e985.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e580134.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e580134.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e580134.exe -
Processes:
e580134.exee57e985.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e580134.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e985.exe -
Enumerates connected drives 3 TTPs 9 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e57e985.exedescription ioc process File opened (read-only) \??\N: e57e985.exe File opened (read-only) \??\G: e57e985.exe File opened (read-only) \??\I: e57e985.exe File opened (read-only) \??\L: e57e985.exe File opened (read-only) \??\K: e57e985.exe File opened (read-only) \??\M: e57e985.exe File opened (read-only) \??\E: e57e985.exe File opened (read-only) \??\H: e57e985.exe File opened (read-only) \??\J: e57e985.exe -
Drops file in Windows directory 3 IoCs
Processes:
e57e985.exee580134.exedescription ioc process File created C:\Windows\e57ece0 e57e985.exe File opened for modification C:\Windows\SYSTEM.INI e57e985.exe File created C:\Windows\e5845ed e580134.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e57e985.exee580134.exepid process 2368 e57e985.exe 2368 e57e985.exe 2368 e57e985.exe 2368 e57e985.exe 4036 e580134.exe 4036 e580134.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e57e985.exedescription pid process Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe Token: SeDebugPrivilege 2368 e57e985.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee57e985.exedescription pid process target process PID 4836 wrote to memory of 4456 4836 rundll32.exe rundll32.exe PID 4836 wrote to memory of 4456 4836 rundll32.exe rundll32.exe PID 4836 wrote to memory of 4456 4836 rundll32.exe rundll32.exe PID 4456 wrote to memory of 2368 4456 rundll32.exe e57e985.exe PID 4456 wrote to memory of 2368 4456 rundll32.exe e57e985.exe PID 4456 wrote to memory of 2368 4456 rundll32.exe e57e985.exe PID 2368 wrote to memory of 808 2368 e57e985.exe fontdrvhost.exe PID 2368 wrote to memory of 816 2368 e57e985.exe fontdrvhost.exe PID 2368 wrote to memory of 408 2368 e57e985.exe dwm.exe PID 2368 wrote to memory of 2404 2368 e57e985.exe sihost.exe PID 2368 wrote to memory of 2420 2368 e57e985.exe svchost.exe PID 2368 wrote to memory of 2508 2368 e57e985.exe taskhostw.exe PID 2368 wrote to memory of 3316 2368 e57e985.exe Explorer.EXE PID 2368 wrote to memory of 3492 2368 e57e985.exe svchost.exe PID 2368 wrote to memory of 3712 2368 e57e985.exe DllHost.exe PID 2368 wrote to memory of 3808 2368 e57e985.exe StartMenuExperienceHost.exe PID 2368 wrote to memory of 3904 2368 e57e985.exe RuntimeBroker.exe PID 2368 wrote to memory of 4016 2368 e57e985.exe SearchApp.exe PID 2368 wrote to memory of 3332 2368 e57e985.exe RuntimeBroker.exe PID 2368 wrote to memory of 1980 2368 e57e985.exe RuntimeBroker.exe PID 2368 wrote to memory of 3216 2368 e57e985.exe TextInputHost.exe PID 2368 wrote to memory of 4192 2368 e57e985.exe msedge.exe PID 2368 wrote to memory of 2572 2368 e57e985.exe msedge.exe PID 2368 wrote to memory of 2412 2368 e57e985.exe msedge.exe PID 2368 wrote to memory of 2436 2368 e57e985.exe msedge.exe PID 2368 wrote to memory of 1828 2368 e57e985.exe msedge.exe PID 2368 wrote to memory of 940 2368 e57e985.exe msedge.exe PID 2368 wrote to memory of 2684 2368 e57e985.exe msedge.exe PID 2368 wrote to memory of 4996 2368 e57e985.exe backgroundTaskHost.exe PID 2368 wrote to memory of 4836 2368 e57e985.exe rundll32.exe PID 2368 wrote to memory of 4456 2368 e57e985.exe rundll32.exe PID 2368 wrote to memory of 4456 2368 e57e985.exe rundll32.exe PID 4456 wrote to memory of 2896 4456 rundll32.exe e57f03c.exe PID 4456 wrote to memory of 2896 4456 rundll32.exe e57f03c.exe PID 4456 wrote to memory of 2896 4456 rundll32.exe e57f03c.exe PID 2368 wrote to memory of 3472 2368 e57e985.exe RuntimeBroker.exe PID 2368 wrote to memory of 2576 2368 e57e985.exe RuntimeBroker.exe PID 2368 wrote to memory of 2872 2368 e57e985.exe DllHost.exe PID 4456 wrote to memory of 4036 4456 rundll32.exe e580134.exe PID 4456 wrote to memory of 4036 4456 rundll32.exe e580134.exe PID 4456 wrote to memory of 4036 4456 rundll32.exe e580134.exe PID 4456 wrote to memory of 1724 4456 rundll32.exe e5801d0.exe PID 4456 wrote to memory of 1724 4456 rundll32.exe e5801d0.exe PID 4456 wrote to memory of 1724 4456 rundll32.exe e5801d0.exe PID 2368 wrote to memory of 808 2368 e57e985.exe fontdrvhost.exe PID 2368 wrote to memory of 816 2368 e57e985.exe fontdrvhost.exe PID 2368 wrote to memory of 408 2368 e57e985.exe dwm.exe PID 2368 wrote to memory of 2404 2368 e57e985.exe sihost.exe PID 2368 wrote to memory of 2420 2368 e57e985.exe svchost.exe PID 2368 wrote to memory of 2508 2368 e57e985.exe taskhostw.exe PID 2368 wrote to memory of 3316 2368 e57e985.exe Explorer.EXE PID 2368 wrote to memory of 3492 2368 e57e985.exe svchost.exe PID 2368 wrote to memory of 3712 2368 e57e985.exe DllHost.exe PID 2368 wrote to memory of 3808 2368 e57e985.exe StartMenuExperienceHost.exe PID 2368 wrote to memory of 3904 2368 e57e985.exe RuntimeBroker.exe PID 2368 wrote to memory of 4016 2368 e57e985.exe SearchApp.exe PID 2368 wrote to memory of 3332 2368 e57e985.exe RuntimeBroker.exe PID 2368 wrote to memory of 1980 2368 e57e985.exe RuntimeBroker.exe PID 2368 wrote to memory of 3216 2368 e57e985.exe TextInputHost.exe PID 2368 wrote to memory of 4192 2368 e57e985.exe msedge.exe PID 2368 wrote to memory of 2572 2368 e57e985.exe msedge.exe PID 2368 wrote to memory of 2412 2368 e57e985.exe msedge.exe PID 2368 wrote to memory of 2436 2368 e57e985.exe msedge.exe PID 2368 wrote to memory of 1828 2368 e57e985.exe msedge.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e57e985.exee580134.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e985.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e580134.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f777dad2191c26d1472b8e4c612fc1c372e810adc851fafa7601a819bda1c10.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f777dad2191c26d1472b8e4c612fc1c372e810adc851fafa7601a819bda1c10.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e57e985.exeC:\Users\Admin\AppData\Local\Temp\e57e985.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e57f03c.exeC:\Users\Admin\AppData\Local\Temp\e57f03c.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e580134.exeC:\Users\Admin\AppData\Local\Temp\e580134.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e5801d0.exeC:\Users\Admin\AppData\Local\Temp\e5801d0.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffc1a842e98,0x7ffc1a842ea4,0x7ffc1a842eb02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2240 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2560 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5264 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5580 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3920 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:82⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e57e985.exeFilesize
97KB
MD5de0127a559d62dacdb9661e993e8b6d8
SHA102f9f4bea94bba2907744d8d14406c21d891f054
SHA256927eeaf443b9ac9ff4acc1165b9167fefdfa6181a35675ffc6435f0804238ac7
SHA51220cb05cd8413e5b7375fe6738e0784134bb3297c28059b5f43ed61af0d3ffab47722a69b5cb6e3a1328d0dd95dcb1526e0a346545a1372732e93dc4d6f5d85bc
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5ef2f0a713fd1fe494f5a19eb7b12f170
SHA156a519245115e081335583a92412f8a3ebd12143
SHA256d7df686279f3e57c93b0062d1ab65395cb698e60985080fa7b893a91ef6a6987
SHA512f184b6657e052a78d0d46cf7c9e2ca017f85d29adc7bf6905f587743dcb8b19136e59efe2abd87ab53641bada3030f7db3d5be1dc63c087433fe20a2cc598b21
-
memory/1724-65-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1724-141-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1724-66-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2368-50-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-71-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2368-6-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-53-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-10-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-19-0x0000000003D30000-0x0000000003D31000-memory.dmpFilesize
4KB
-
memory/2368-18-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-23-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/2368-101-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2368-29-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-30-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-31-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-32-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-52-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-33-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-35-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-36-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-82-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-93-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/2368-48-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-80-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-34-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-78-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-67-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-76-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-73-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-57-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-54-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-8-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2368-9-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/2896-60-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2896-22-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2896-104-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2896-58-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4036-62-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4036-142-0x0000000000B50000-0x0000000001C0A000-memory.dmpFilesize
16.7MB
-
memory/4036-63-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4036-68-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4036-45-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4036-106-0x0000000000B50000-0x0000000001C0A000-memory.dmpFilesize
16.7MB
-
memory/4036-143-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4456-11-0x00000000045F0000-0x00000000045F2000-memory.dmpFilesize
8KB
-
memory/4456-47-0x00000000045F0000-0x00000000045F2000-memory.dmpFilesize
8KB
-
memory/4456-15-0x00000000045F0000-0x00000000045F2000-memory.dmpFilesize
8KB
-
memory/4456-12-0x00000000045F0000-0x00000000045F2000-memory.dmpFilesize
8KB
-
memory/4456-13-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/4456-0-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB